Skip to content

Securely use users-permissions's JWT on cookies 🍪

Notifications You must be signed in to change notification settings

bwyx/strapi-jwt-cookies

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

33 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Strapi JWT Cookies

Securely use users-permissions's JWT on cookies. Compatible with Strapi v4 and requires @strapi/plugin-users-permissions@^4.1.12

@bwyx/strapi-jwt-cookies on npm

How this package works

This package extends the @strapi/plugin-users-permissions core plugin via Extending a plugin's interface. It exports a higher-order function to wrap strapi-server customization.

What this package does to the plugin

Features

  • Split JWT into two cookies, httpOnly for JWT header.signature and javascript-accessible cookie for the payload, so frontend can easily read the JWT payload. read it more here
  • Automatically log out on user inactivity by setting cookie expires

How About CSRF?

Note that this package doesn't add a CSRF prevention mechanism, but it does ensure the request is from the frontend by using SameSite flag sets to lax, and by checking request custom headers which only can be sent from the same CORS domain.

  • set X-Requested-With to XMLHttpRequest to be able receive and validate jwt cookies on the server

Install

npm install --save @bwyx/strapi-jwt-cookies

Create file under directory src/extensions/users-permissions/strapi-server.js:

// src/extensions/users-permissions/strapi-server.js

module.exports = require('@bwyx/strapi-jwt-cookies')(); 

If you already extend the strapi-server.js, you could wrap your function like this:

const withJwtCookie = require('@bwyx/strapi-jwt-cookies');

module.exports = withJwtCookie((plugin) => {
  // some customization

  return plugin
});

Then add the global middleware, this middleware reconstructs JWT from request cookies and then assigns it to headers.authorization

// config/middlewares.js

module.exports = [
  'strapi::errors',
  ...
  'strapi::public',
  'plugin::users-permissions.jwtCookieGetter'
]

Configurations

By default, frontend users will be logged out after 30 mins of inactivy (not make an api request)

COOKIE_PAYLOAD_LIFESPAN_MINUTES=30

You can restrict the cookie to your specific frontend domain (recommended):

FRONTEND_DOMAIN=myfrontend.com

The default cookies name are user for the payload and token for headers.signature, you can prefix the cookies name with env

APP_NAME=myapp

then the cookies will be myapp_user and myapp_token

TODO

  • Add test (?)

References